CVE-2019-19551
lowpriority · track · 19EPSS 0.006 · 46 %ileEUUSEPSS · scored 2026-10-28
In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX, XSS exists in the User Management screen of the Administrator web site. An attacker with access to the User Control Panel application can submit malicious values in some of the time/date formatting and time-zone fields. These fields are not being properly sanitized. If this is done and a user (such as an admin) visits the User Management screen and views that user's profile, the XSS payload will render and execute in the context of the victim user's account.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.5–4.8
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (4)
External citations — patches, advisories, analysis.
- https://nvd.nist.gov/vuln/detail/CVE-2019-19551cnnvd
- https://wiki.freepbx.org/display/FOP/2019-12-03+Multiple+XSS+Vulnerabilitiescnnvd
- https://wiki.freepbx.org/display/FOP/2019-12-03+Multiple+XSS+Vulnerabilitiesenisa_euvd
- https://wiki.freepbx.org/display/FOP/2019-12-03+Multiple+XSS+VulnerabilitiesVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan